The request “set up the new employee” is incomplete until someone has authorized the role and identified the systems the person will use. Good onboarding establishes an access record that can later support a transfer or departure.
Prepare the first working day from the account source
The access record should support the employee's start and later role changes.
Establish the account source first
Identify the directory or identity platform where the user is created and the administrator responsible for it. This may be Active Directory, cloud identity, another directory accessed through LDAP, or an application’s own account system. Hybrid environments need an understood provisioning path. Account creation depends on that foundation and its supporting services.
The authorized manager establishes the role, start date, required applications, and information access. IT and the application owners implement that decision. Use a role-based starting point and check the exceptions; copying another employee’s entire access can copy years of unnecessary permissions.
Complete a usable handover
Coordinate the device, licenses, MFA and recovery, shared-resource access, training, and support instructions. Test with the user’s ordinary account. Confirm that the intended work can be done and that privileged or restricted functions remain unavailable unless approved.
Microsoft’s Entra role guidance explains least privilege through permissions, scope, and duration. Apply the same discipline to application roles and any approved administrative access, using the controls available in each system.
Keep the manager’s approval, access assignments, asset responsibility, application owners, and unresolved items in the work record. Temporary and contractor access needs an end condition and someone who will verify removal; a shorter sign-in session is not an employment-expiration process.
Give the staff member, internal IT team, and relevant providers the handover information they need. Connect the approved access record to offboarding, credentials, and periodic review. Later role changes can then start with known assignments and owners instead of a search for every place the employee may have signed up.